How to configure Iptables with PORT forwarding

gurdeep.singh · 07-16-2007, 03:29 AM

Hi
i am new in linux.i Want to share internet and port forwarding. what rules should i add to iptables
Thanks
Gurdeep

satishssquid · 07-16-2007, 06:26 AM

For Port Forwading

Edit the file /etc/sysctl.conf

and set the value to

net.ipv4.ip_forward = 0

to 1

net.ipv4.ip_forward = 1

And if your using the static ipaddress for Internet

then under the postrouting rule define a rule.

if you use dial up for internet then use the Masquerade rule.

win32sux · 07-16-2007, 02:07 PM

Quote:

Originally Posted by satishssquid

And if your using the static ipaddress for Internet

then under the postrouting rule define a rule.

if you use dial up for internet then use the Masquerade rule.

To add to this: Here's what those commands actually look like:

Code:

iptables -t nat -A POSTROUTING -o eth0 -j SNAT \
--to-source 1.2.3.4

Code:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

These assume eth0 is the name of your external interface, and 1.2.3.4 is the static IP it has. As you can see, the MASQUERADE target doesn't need a static IP, which makes it perfect for dynamic connections, but it will work fine regardless.

gurdeep.singh · 07-16-2007, 11:11 PM

Hi
thanks to all. i am using static ip address. these rules working for internet sharing, but how can i forward vnc request on static ip to my local lan computer.
Thanks

win32sux · 07-18-2007, 02:00 PM

Quote:

Originally Posted by gurdeep.singh

Hi
thanks to all. i am using static ip address. these rules working for internet sharing, but how can i forward vnc request on static ip to my local lan computer.
Thanks

It would go like:

Code:

iptables -t nat -A PREROUTING -p TCP -i eth0 --dport XXX \
-j DNAT --to-destination 192.168.123.123

Replace XXX with whatever port or port range VNC uses.

gurdeep.singh · 07-20-2007, 07:05 AM

Hi
Dear Friends this rule is not working when i attempt to connect by VNC from Remote network. it gives me error Connection Refused
any other rules
Thanks
Gurdeep Singh

bakfupai · 07-24-2007, 12:12 PM

Connection refused indicates that the connection is not DROPped by the firewall but that it is rejected. This can be because there is some kind of REJECT rule in the firewall or perhaps more likely that the VNC server is not running (at least not on that port).

Also, you should know that using VNC over a insecure network can be risky since most implementations doesn't use encryption. A more secure way to use VNC is to use it over an SSH tunnel:

http://en.wikipedia.org/wiki/Ssh_tunnel